Google Chrome CVE-2026-113007

Exploitation requires the victim to use an affected Google Chrome desktop build prior to 156.0.8078.47 AND to actively load attacker-controlled content - the CVSS UI:R and the description's 'crafted HTML page' mean a user must visit a malicious or compromised page for the bug in the Permissions component to trigger; there is no drive-by-without-interaction path. No authentication is required (PR:N) and no non-default configuration is named in the description - the Permissions feature is a standard built-in Chrome component. The primary limiting factors are the mandatory user interaction (visiting the page), the need for a vulnerable unpatched version, and - per Google's Medium Chromium rating - the likely difficulty of turning the memory corruption into a reliable sandbox escape. Automatic Chrome update channels will remediate most installs quickly, further limiting the exposure window.

Signals conflict and must be reconciled. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 9.6 Critical) describes a network-reachable, low-complexity, unauthenticated sandbox escape - the scope change (S:C) is consistent with the description's claim of code execution 'outside the sandbox,' which is the single most dangerous outcome for a browser bug. However, Google's own Chromium security team rated this only 'Medium,' a notable discrepancy: Chromium ratings weight exploitability and real-world reachability, so the Medium label suggests the memory-corruption primitive may be hard to weaponize into a reliable full-chain exploit despite the high CVSS. No EPSS score, KEV listing, or public POC is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is not currently a confirmed emergency. Net assessment: treat as a high-priority patch because the product is ubiquitous and a patch exists (so n-day exploitation risk rises once the fix is diffed), but the absence of EPSS/KEV/POC and Google's Medium rating argue against treating it as an in-the-wild zero-day. The vendor's Medium rating versus the 9.6 CVSS should be reconciled before escalating to emergency status.

A victim running an unpatched Chrome build (<156.0.8078.47) is lured to a malicious or compromised web page that serves crafted HTML targeting the Permissions component. Triggering the memory-corruption bug lets the attacker potentially break out of the renderer sandbox and execute arbitrary code on the host with the browser user's privileges. No public exploit code is identified in the provided data, and the attack requires the user to actually load the page (UI:R).